It could boil down to having other intelligence fingering China, but the US doesn't want to expose and consequently draw attention to the source of the information.

If the US doesn't have some 99.9999% assurance it was China and they made a statement like that with egg still on their face from the breach, it's pretty sad. I don't rule it out, but the US probably has more common sense than that. From a technical perspective, it sure was a fast "investigation".